Critical SharePoint RCE: CVE-2025-53770 and the Perils of Deserialization
CVE-2025-53770 is under active exploitation, gives unauthenticated attackers remote code execution, and has no patch yet. Every organization running on-premises SharePoint Server should treat it as urgent.
Introduction
Attackers are breaching enterprise SharePoint deployments and gaining remote code execution with no credentials. CVE-2025-53770 is being exploited in the wild, and Microsoft has not yet released a patch. The flaw opens SharePoint's data processing to deserialization attacks, which lets adversaries hijack servers, deploy webshells, and move laterally across networks.
Technical Information
CVE-2025-53770 is a classic case of unsafe deserialization of untrusted data (CWE-502) in on-premises Microsoft SharePoint Server, and a severe one. The flaw lies in how SharePoint handles serialized .NET objects. It does not properly validate or sanitize serialized input that arrives in network requests.
Vulnerability Mechanism
- Attack Vector: Remote, unauthenticated attackers send crafted HTTP POST requests containing malicious serialized .NET payloads to SharePoint endpoints such as
/_api/web/lists. - Trigger: SharePoint deserializes the input with legacy .NET mechanisms such as
BinaryFormatter. These mechanisms are insecure by design and can execute arbitrary code embedded in the payload. - Impact: The attacker's code runs in the context of the SharePoint application pool. From there the attacker can fully compromise the system, deploy webshells, and move laterally.
Exploitation Flow
Unauthenticated users can exploit the vulnerability remotely, which sharply raises the risk for any exposed SharePoint instance. Attackers typically deploy webshells (malicious .aspx files) or run system commands to establish persistence and expand their access.
Root Cause
SharePoint relies on insecure deserialization routines to process user-supplied data. That is a well-documented anti-pattern in .NET applications, especially with BinaryFormatter and similar APIs. Because SharePoint applies no input validation or type restrictions, attackers can supply arbitrary objects that trigger code execution when they are deserialized.
Affected Systems and Versions
- Microsoft SharePoint Server Subscription Edition (prior to 16.0.18526.20286)
- Microsoft SharePoint Server 2019 (all versions prior to the forthcoming patch)
- Microsoft SharePoint Server 2016 Enterprise Edition (all versions prior to the forthcoming patch)
Any on-premises deployment that processes serialized data through exposed endpoints is at risk. Cloud-hosted SharePoint Online is not affected.
Vendor Security History
Deserialization vulnerabilities have turned up in Microsoft SharePoint repeatedly:
- CVE-2025-30382: Deserialization RCE, exploited in the wild.
- CVE-2025-30384: Similar vector, patched in 2025.
- CVE-2024-38094: An earlier critical deserialization flaw.
Microsoft patches on a regular cadence, but unsafe deserialization remains a persistent problem in SharePoint's legacy codebase.
References
- Microsoft Security Response Center Advisory
- NVD Entry for CVE-2025-53770
- Official CVE Entry
- Zeropath: SharePoint Deserialization RCE Analysis
- OWASP: Deserialization of Untrusted Data
- Waratek: Best Practices for Unsafe Deserialization
Security teams must act now. Until a patch is released, restrict network access, monitor for suspicious POST requests, and follow Microsoft's mitigation guidance.
Source: This report was created using AI
If you have suggestions for improvement or feedback, email us at [email protected].
